Russian Banks Again Spitting Out Money

Russian daily Kommersant reports that the Bank of Russia detected malware that hides inside ATM’s operating memory which “forces” them to dispense cash to anyone who enters certain code on its keyboard. The paper cites the deputy head of information security Artem Sychev, and adds that cash machines made by NCR were among the ATMs mostly attacked. Dmitry Kuznetsov, Methodology and Standardization Director, Positive Technologies commented below.

Dmitry Kuznetsov, Methodology and Standardization Director at Positive Technologies:

“I have encountered disembodied malware for the first time in 2001, and it is still there. Moreover ATMs are now even more vulnerable than PCs, because they keep using older versions of Windows OS. How it works: the virus gets into an ATM’s OS (for the most cases – it is Windows XP) through some vulnerability. It is immediately “injected” into the RAM and remains there. In this case there is no file which can be analyzed by an antivirus. As a result, the virus “lives and works” inside the RAM. If the ATM is rebooted because of some occurred problems, the virus disappears”.

“While this is the first Russian targeted scheme, it’s not the first of its kind as there have been previous incidents for example, in Belarus in 2015, an ATM-network of an ‘Alfa-bank’ subsidiary was attacked. That said, this type of ‘disembodied’ malware has been around far longer – my first encounter was back in 2001. The malware earns the monicker ‘disembodied’ as to all intents and purposes it is file-less making it practically invisible. The virus will infiltrate the ATM’s Operating Software (in most cases this is Windows XP) through an existing vulnerability and is then immediately ‘injected’ into the RAM (Random Access Memory) where it remains concealed. As there is typically no file, it isn’t identified or analysed by an antivirus program (assuming one is used) so it continues to ‘live and work’ within the RAM. Should an error occur, and the ATM be rebooted, the virus disappears.

“At the moment cybercriminals continue to hack the external perimeter of a bank network looking to identify and penetrate an employee’s computer who has responsibility for the bank’s ATM-network, and from there push the virus into the ATM-network closed loop. The use of a ‘disembodied’ virus is still a relatively unusual attack method, performed by professional cybercriminals as it requires some serious and complicated expertise, but it is unlikely to remain that way indefinitely.

“Criminals will typically look to gain a foothold within the enterprise by first compromising a users workstation, with phishing still the modus operandi, so to thwart attacks employee security training must form part of the overall action plan. In combination banks need to find and fix the vulnerabilities malware exploits. By running smart technology, which continually checks for and addresses such flaws and the resultant attacks, can banks protect themselves.”